Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-115353

Mistune before 3.3.0 Path Traversal via include Directive

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

lepture mistune

Default version status: unaffected

  • 0 to < 3.3.0affected
  • 3.3.0unaffected
pkg:pypi/mistune

References